I work for a Social Welfare Center in Greece, that consists of 5 separate institutions, located on a radius of roughly 150 km. 4 of those are effectively connected through Syzefxis which is a national project for various telecommunications, including a 255.255.255.0 subnet for each institution. That said, we were able to allow LAN access in-between 4 institutions easily, which has really improved data centralization, etc.
To clarify my position, I am a PHP developer, with a small background in software development and a relatively small experience in networking and administration. Being the only tech-related employee, I am practically administrating the whole network, also repairing all PCs (including really old ones), developing our website and doing anything related to not-only electronic devices, in general. (At this point, you should already feel some compassion for me... Honestly, they ask me to fix everything from a network switch, to an air-conditioner remote controller, to perforators, etc).
At this point, the problem for our network is clear. One of our institutions is in desperate need of access to our LAN. We currently have two options:
A) Either set up our own VPN -or-
B) Ask our ISP (SYZEFXIS) to provide a remote-connection point (as they call it), which is practically the same thing, but we will pay a monthly fee for it.
I would be glad to hear any other option you might suggest, as this is our real problem.
I have taken the liberty to try and setup our own VPN on our institution server, which is also our web server, our file server, our proxy server and the only machine with two pshysical IPs. The IP that is used by all those services is 10.169.31.29. So, I installed the "Network Policy and Access Services" Server Role, without RADIUS and set it to its other IP, which is not occupied by other roles: 10.169.31.31.
Although, here are some restrictions that have made it very hard for me to continue:
1) I cannot do my own port-forwarding. I can only ask our ISP to open some ports, which requires days wasted by bureaucracy, so I cannot test my vpn from outside the LAN.
2) Our server OS is Windows Server 2008 R2, and the client machines are Windows XP (probably Home editions). And unfortunately, I cannot change that.
3) Once I get the client machines connected to the first subnet, I would need to somehow grant access to all 4 subnets (which means access to 255.255.0.0).
4) Our LAN has no DHCP. All IPs within SYZEFXIS must be manually set.
1) Can I test the VPN from another subnet within the LAN? I have tried to do so, but I get various errors, for which I am unsure whether they relate to the fact that I am trying to connect to a LAN that I am already part of, or to the existing configuration.
Some of these errors are:
- Error 800: Unable to Establish Connection
- Error 13806
- Error 913
2) Based on the fact that this server is already playing many roles, would it be preferable to avoid setting up a VPN on it and just go with the paid solution by our ISP?
3) Despite being highly unlikely, if I ever get this VPN up and running, will it automatically allow clients to access all 4 subnets, or should I somehow configure that?
I have already tried finding solutions to the errors online, but I can't seem to get anything straight in my head. Please excuse the length of my question and thank you for your time reading so far.